Ticket #18194: files-sessions-server-expiry-2.patch

django/contrib/sessions/backends/file.py

@@ -1 +1 @@
 import errno
 import os
 import tempfile
+import time
 
 from django.conf import settings
 from django.contrib.sessions.backends.base import SessionBase, CreateError
@@ -49 +50 @@
         try:
             with open(self._key_to_file(), "rb") as session_file:
                 file_data = session_file.read()
-            # Don't fail if there is no data in the session file.
-            # We may have opened the empty placeholder file.
-            if file_data:
-                try:
-                    session_data = self.decode(file_data)
-                except (EOFError, SuspiciousOperation):
+                # Create new session in case of an expired one
+                if self._expired():
                     self.create()
+                # Don't fail if there is no data in the session file.
+                # We may have opened the empty placeholder file.
+                elif file_data:
+                    try:
+                        session_data = self.decode(file_data)
+                    except (EOFError, SuspiciousOperation):
+                        self.create()
         except IOError:
             self.create()
         return session_data
@@ -127 +131 @@
         except (OSError, IOError, EOFError):
             pass
 
+    def _expired(self):
+        # The age of session file from last modify time
+        age = time.time() - os.path.getmtime(self._key_to_file())
+        return age > settings.SESSION_COOKIE_AGE
+
     def exists(self, session_key):
         return os.path.exists(self._key_to_file(session_key))
 

django/contrib/sessions/tests.py

@@ -345 +345 @@
         self.assertRaises(SuspiciousOperation,
                           self.backend("a/b/c").load)
 
+    # This test fails with cookie and cache session, thats why added it to
+    # file tests only.
+    @override_settings(SESSION_COOKIE_AGE=0)
+    def test_onload_expiry_check(self):
+        """
+        Test to ensure that expiry of session is checked on-load
+        """
+
+        self.session['test-data'] = True
+        old_key = self.session.session_key
+        self.session.save()
+        self.assertTrue(self.session.get('test-data'))
+        self.session.load()
+        new_key = self.session.session_key
+
+        # Make sure a new key was generated after the invalidation of the old
+        # one.
+        self.assertNotEqual(old_key, new_key)
+        # The key test-data should not be present in the session.
+        self.assertFalse(self.session.get('test-data'))
 
 class CacheSessionTests(SessionTestsMixin, unittest.TestCase):